fix(controllers): Migrate to proper "multiple bruteforce protections" support

Signed-off-by: Joas Schilling <coding@schilljs.com>

3 files changed, 26 insertions, 22 deletions

diff --git a/lib/Controller/RoomController.php b/lib/Controller/RoomController.php
index 23e7953ff..8d4f9d2a4 100644
--- a/lib/Controller/RoomController.php
+++ b/lib/Controller/RoomController.php
@@ -318,15 +318,14 @@ class RoomController extends AEnvironmentAwareController {
 	 * @return DataResponse
 	 */
 	#[BruteForceProtection(action: 'talkRoomToken')]
+	#[BruteForceProtection(action: 'talkSipBridgeSecret')]
 	public function getSingleRoom(string $token): DataResponse {
 		try {
 			$isSIPBridgeRequest = $this->validateSIPBridgeRequest($token);
 		} catch (UnauthorizedException $e) {
-			$ip = $this->request->getRemoteAddress();
-			$action = 'talkSipBridgeSecret';
-			$this->throttler->sleepDelay($ip, $action);
-			$this->throttler->registerAttempt($action, $ip);
-			return new DataResponse([], Http::STATUS_UNAUTHORIZED);
+			$response = new DataResponse([], Http::STATUS_UNAUTHORIZED);
+			$response->throttle(['action' => 'talkSipBridgeSecret']);
+			return $response;
 		}
 
 		// The SIP bridge only needs room details (public, sip enabled, lobby state, etc)
diff --git a/lib/Controller/SignalingController.php b/lib/Controller/SignalingController.php
index bff25ff8e..4fb627b85 100644
--- a/lib/Controller/SignalingController.php
+++ b/lib/Controller/SignalingController.php
@@ -61,7 +61,6 @@ class SignalingController extends OCSController {
 
 	public const EVENT_BACKEND_SIGNALING_ROOMS = self::class . '::signalingBackendRoom';
 
-	private IConfig $serverConfig;
 	private Config $talkConfig;
 	private \OCA\Talk\Signaling\Manager $signalingManager;
 	private TalkSession $session;
@@ -74,7 +73,6 @@ class SignalingController extends OCSController {
 	private IEventDispatcher $dispatcher;
 	private ITimeFactory $timeFactory;
 	private IClientService $clientService;
-	private IThrottler $throttler;
 	private LoggerInterface $logger;
 	private ?string $userId;
 
@@ -99,7 +97,6 @@ class SignalingController extends OCSController {
 		?string $UserId,
 	) {
 		parent::__construct($appName, $request);
-		$this->serverConfig = $serverConfig;
 		$this->talkConfig = $talkConfig;
 		$this->signalingManager = $signalingManager;
 		$this->session = $session;
@@ -112,7 +109,6 @@ class SignalingController extends OCSController {
 		$this->dispatcher = $dispatcher;
 		$this->timeFactory = $timeFactory;
 		$this->clientService = $clientService;
-		$this->throttler = $throttler;
 		$this->logger = $logger;
 		$this->userId = $UserId;
 	}
@@ -151,16 +147,15 @@ class SignalingController extends OCSController {
 	 * @return DataResponse
 	 */
 	#[BruteForceProtection(action: 'talkRoomToken')]
+	#[BruteForceProtection(action: 'talkRecordingSecret')]
 	public function getSettings(string $token = ''): DataResponse {
 		$isRecordingRequest = false;
 
 		if (!empty($this->request->getHeader('Talk-Recording-Random')) || !empty($this->request->getHeader('Talk-Recording-Checksum'))) {
 			if (!$this->validateRecordingBackendRequest('')) {
-				$ip = $this->request->getRemoteAddress();
-				$action = 'talkRecordingSecret';
-				$this->throttler->sleepDelay($ip, $action);
-				$this->throttler->registerAttempt($action, $ip);
-				return new DataResponse([], Http::STATUS_UNAUTHORIZED);
+				$response = new DataResponse([], Http::STATUS_UNAUTHORIZED);
+				$response->throttle(['action' => 'talkRecordingSecret']);
+				return $response;
 			}
 
 			$isRecordingRequest = true;
diff --git a/lib/Middleware/InjectionMiddleware.php b/lib/Middleware/InjectionMiddleware.php
index 67e10d566..e697cc201 100644
--- a/lib/Middleware/InjectionMiddleware.php
+++ b/lib/Middleware/InjectionMiddleware.php
@@ -39,6 +39,7 @@ use OCA\Talk\TalkSession;
 use OCA\Talk\Webinary;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\RedirectToDefaultAppResponse;
 use OCP\AppFramework\Http\Response;
 use OCP\AppFramework\Middleware;
@@ -263,15 +264,24 @@ class InjectionMiddleware extends Middleware {
 		if ($exception instanceof RoomNotFoundException ||
 			$exception instanceof ParticipantNotFoundException) {
 			if ($controller instanceof OCSController) {
-				$isBruteForceProtected = $this->reflector->hasAnnotation('BruteForceProtection');
-				if ($isBruteForceProtected) {
-					$ip = $this->request->getRemoteAddress();
-					$action = 'talkRoomToken';
-					$this->throttler->sleepDelay($ip, $action);
-					$this->throttler->registerAttempt($action, $ip, [
-						'token' => $this->request->getParam('token') ?? '',
-					]);
+				$reflectionMethod = new \ReflectionMethod($controller, $methodName);
+				$attributes = $reflectionMethod->getAttributes(BruteForceProtection::class);
+
+				if (!empty($attributes)) {
+					foreach ($attributes as $attribute) {
+						/** @var BruteForceProtection $protection */
+						$protection = $attribute->newInstance();
+						$action = $protection->getAction();
+
+						if ('talkRoomToken' === $action) {
+							$this->throttler->sleepDelay($this->request->getRemoteAddress(), $action);
+							$this->throttler->registerAttempt($action, $this->request->getRemoteAddress(), [
+								'token' => $this->request->getParam('token') ?? '',
+							]);
+						}
+					}
 				}
+
 				throw new OCSException('', Http::STATUS_NOT_FOUND);
 			}